Okay, so I have to share this because it’s been a game-changer for our team’s workflow. For context, we’re a mid-sized company that’s been deep in HubSpot for marketing and sales, but our IT infrastructure was, until recently, pretty traditional. We’ve been running an on-premise Active Directory with Certificate Services (AD CS) for years, primarily to handle certificate-based authentication for our corporate Wi-Fi. It worked, but it was... clunky.
The manual process of issuing, renewing, and revoking certificates was a constant drain on our IT team's time. Plus, with our shift to more remote and hybrid work, the friction for onboarding new devices was real. We’d have to guide people through manual certificate installs, and if something expired? Support tickets galore. Not exactly a seamless user experience.
We finally made the jump to using **Microsoft Entra ID (formerly Azure AD) for certificate-based authentication for our Wi-Fi**, and I can't believe we didn't do this sooner. The management overhead has dropped dramatically. Here’s the breakdown from an admin perspective:
* **Provisioning is now automated and tied to identity.** We set up the SCEP (Simple Certificate Enrollment Protocol) profile in Intune/Endpoint Manager. Now, when a device is enrolled and compliant, it just automatically gets the Wi-Fi certificate pushed to it. New hire onboarding is infinitely smoother.
* **Lifecycle management is centralized.** Revoking access when someone leaves? It happens instantly as part of the offboarding workflow in Entra ID. Certificate renewal happens silently in the background. The IT team has gone from reactive firefighting to just managing policies.
* **The integration with our existing M365/Entra ecosystem is the real win.** Since we're already using Entra ID for Single Sign-On to everything from Salesforce to Marketo, extending that trust to our network access feels natural. It’s one less siloed system to worry about.
I’m curious—has anyone else here made a similar transition? I’m particularly interested in:
* **Pitfalls to watch for:** We had some initial hiccups with older macOS devices and the SCEP profile, but got it sorted.
* **Advanced use cases:** Are you using this for VPN authentication as well? We’re looking at that next.
* **Reporting & Analytics:** How are you tracking certificate deployment status and compliance? The built-in Intune reports are good, but I’m wondering if anyone has built custom dashboards.
From a marketing ops perspective, this might seem off-topic, but a secure, frictionless onboarding process for employees directly impacts how quickly our new sales and marketing hires can access their tools (HubSpot, Salesforce, etc.). It’s all connected!
— Emma
If it's not measurable, it's not marketing.
I'm a systems engineer at a 300-person professional services firm, and I manage the entire developer toolchain and endpoint security stack. We migrated from an on-prem AD CS setup to Entra ID certificates for 802.1X Wi-Fi auth about 18 months ago, and it's been our primary prod auth method since.
* **Deployment and Identity Integration Effort:** The initial SCEP profile and NDES connector setup takes 2-3 days of focused work for an engineer who knows Entra ID. The major win is it's all declarative policy tied directly to Entra ID groups, so assigning a new hire to the "Wi-Fi Cert Users" group triggers the entire certificate push to their Intune-managed device with zero touch.
* **Recurring Admin Overhead and Cost:** Our absolute biggest saving is time. We went from 10-15 hours a month of manual cert operations (renewals, revokes, troubleshooting installs) to maybe 1 hour. The cost is essentially bundled into our existing Entra ID P1 and Intune licenses, which run us about $9/user/month. No separate server upkeep or CALs.
* **Real Limitation - Non-Managed and BYOD Devices:** This breaks down for contractor or personal devices not enrolled in Intune. The user experience for getting a cert onto a macOS laptop you don't manage is still clunky, often requiring a manual download from the company portal and a guide. It's not a true zero-touch for that segment.
* **Operational Clarity and Auditing:** Revocation is instant and centralized. Disabling a user's Entra ID account immediately invalidates their cert for Wi-Fi auth, which was a 2-step process (disable AD, then revoke cert) in our old world. The audit log for certificate issuance in Entra ID is also far easier to parse than digging through AD CS logs.
For a company that's already paying for Microsoft 365 and manages company devices with Intune, the Entra ID path is a no-brainer for the core use case. If you have a massive population of non-managed/BYOD devices or you're heavily reliant on certificate auth for non-Wi-Fi purposes like smart card logon, tell us that - it's where the hybrid or on-prem model might still have legs.
editor is my home